Entries Tagged 'Access Control' ↓

Customizing vBulletin Login For Single-Signon

Here’s what you need to do to disable the standard vB login form at the top-right corner of your forum pages, and customize it so that you force your members to log in via the DAP login form, so that they’re logged in to your membership site as well as DAP.

  1. Log in to VB Admin control panel at http://yoursite.com/forums/admincp/
  2. Go to Styles & Templates > Style Manager > Default (or whatever style you’re currently using)
  3. From the big list on the left, select the “header” template. Then on the right, under the “Controls” section, click on Edit
  4. On the resulting page, copy the full code from this text file and paste into the main “Template” body, and click on “Save”
  5. Next, download the file forums/register.php from your server, to your desktop and save the original copy somewhere safe.
  6. Replace the contents of that file with the contents of this text file.

That’s it!

Upgrading or Downgrading of Subscriptions

There are two main items that need to be addressed when it comes to a member wanting to Upgrade or Downgrade their Subscription from one membership “level” (a.k.a “Product” in DAP) to another.

1) Modifying the actual recurring payments to reflect the new amount

2) Giving them appropriate access as per the upgrade (or downgrade)

So let’s see how both of these are accomplished.

1) Modifying Recurring Payments

You do need to take some manual action for this. The way to do it is….

  • Ask your members to sign up for the new product/level/subscription separately, like it were a new sign up
  • Cancel their old subscription manually. When using Paypal standard, this can be done by both you (as the admin) and the member themselves. But with all of the other payment solutions, you (the admin) will have to log in to the payment gateway (Authorize.net or Paypal Website Payments Pro) and manually delete the member’s old subscription). DAP will not automatically remove user’s old subscription profile in your payment gateway.

2) Giving your member access to new level

Set up automation rules using DAP’s Product Chaining feature, so that if they sign up for one Product (or “level”), they’re automatically removed from another Product (or level).

So if they are currently signed up to your “Gold Membership”, then when they sign up afresh for the “Platinum Membership”, then set up a Product Chaining rule that says, “If member signs up for Platinum Membership, then remove them from Gold Membership”. This is just to make sure that they don’t have access to two products (or “levels”) at the same time.

Creating Member-specific Content

If you have a coaching program, or have clients for whom you’re doing custom work (like if you were a CPA or a web designer), and want to publish content that is available to and downloadable only by that client, then there are THREE ways in which you can do Member-Specific Content in DAP.

1) BEST SOLUTION: Using a combination of a special page for each member PLUS DAP’s “For Your Eyes Only” Shortcode

2) Creating Separate Products for each Member

3) Using DAP’s “For Your Eyes Only” Shortcode

Let’s take a look at each one in detail.

1) BEST SOLUTION: Special page for each member PLUS DAP’s “For Your Eyes Only” Shortcode

This is partly manual, partly automated, but is the absolute best solution for multiple reasons, as explained below.

1) For each new member, you would create a separate page. So, for Joe Customer, you would create a new page in WP – http://YourSite.com/joe-customer/

This page would be created after someone has become a member, of course. But creating a WP page for every member will probably take you about what, 30 seconds? So it’s not going to be a big deal (unless you wish to make it one ;-)

2) Then, assuming Joe Customer’s “userid” in DAP is 144 (you can find this out on the Users > Manage page). So within the above new page, you would add the following shortcode…

[DAP userId="144"]protected content[/DAP]

(See DAP’s “Member-Specific Content” Shortcodes )

3) You can start adding any amount of private content between the shortcode start and end tags (where you see protected content above).

4) You can use a simple, free plugin like Exclude Pages to make sure the customer’s page http://YourSite.com/joe-customer/ does not show up in any of your menu’s. Even if it did, it’s not like anyone else can see the contents of the page – only Joe Customer – after he’s logged in to DAP – can see the contents of the page. So it’s secure from everyone else.

2) Separate Products for each Member

Here, you would create separate products, one per member – and only give that member access to that product. The advantage here, is that you can protect the entire page (not just the content section) and make it available just to that one client, so you can be a lot more creative with this page, use special templates, add sidebar widgets that show content just for that client, use the commenting system to communicate back and forth with the client.

So if you had a client named John Customer, then you would create a DAP Product by name “John Customer”, then take John’s email id and give John access to his product.

And within this DAP Product, you would’ve protected files, pages and posts that only John should get access to. So since only John has access to the product, only he can get access to the content protected as part of this product.

Obviously, it takes a few minutes of additional setup per customer to create a DAP Product specifically for him, but then the few extra minutes of creating a DAP Product would be nothing compared to the few hours (or tens of hours) that you’re actually going to be taking to create the actual custom content for John. So it’s a very small overhead compared to the whole process, where you are actually creating custom content for each member.

3) No special pages, just DAP’s “Member-Specific Content” Shortcode

If you wish to automated this a bit more than Option #2, then one way is to implement this is using DAP’s “Member-Specific Content” Shortcodes, which look like this:

Using the “userId” parameter in the DAP shortcode, you can now protect a piece of content so that only John Customer (who has the user id “144″ in your membership site) user can see it.

[DAP userId="144"]protected content[/DAP]

So on a single page, you may publish a number of these shortcodes, with content meant only for specific members protected within those shortcodes.

And doesn’t matter which one of your members visits the above page, they will all only see content intended only for them, and will be unable to see content intended for others.

So those are the three ways in which you can create Member-Specific Content.

Merging User Accounts

User ID 111 has been created with email id ABC123@somewhere.com

Same user buys a different product using a completely new (Paypal) email id. and DAP creates User ID 999 with PayPal email XYZ789@anothersite.com

User now has 2 accounts and wants only ABC123@somewhere.com (user ID 111) to be active.

So here’s what you should do:

  1. Place XYZ789@anothersite.com in the PayPal email field of User ID 111 and save.
  2. Give User ID 111 access to all products that User ID 999 currently has active, with matching start and end dates.
  3. Delete User ID 999 fully from the system.

If User ID 111 purchases additional products through Paypal, and her primary Paypal email id is still XYZ789@anothersite.com, then that Paypal email id will be recognized by DAP, and all purchased products will be activated under User ID 111 and no additional User IDs will be created.

However, if User ID 111 has changed their primary Paypal email id to be something else like XYZ123@yetanother.com, then the next time they make a purchase, DAP will not know it’s the same person, and will end up creating a completely new user id for the buyer. Which means, you will have to do the merge again, and replace the old Paypal email id in DAP with the new Paypal email id of the buyer.

Optimizing Your WordPress Blog For Speed

Using a “cache” plugin for speeding up your site is like putting band-aid on a gaping wound. It’s only a temporary fix, and not a real long-term solution.

Plus a cache plugin has its place, but it’s certainly not for a membership site, where DAP will need to make calls to the database to figure out who’s viewing the content, are they a member, what products have they purchased, what content do they have access to, etc.

If you want to speed up your web site, you must address the core issue, which is — your web site is getting more traffic than your web server (web hosting account) can handle.

So here are a couple of ways in which you can speed up your web site:

  • The easiest thing you can do is to revisit all of your plugins that you have enabled. Remember that every single plugin adds some overhead to (read “slows down”) your web site or blog. So use only as few plugins as you absolutely must. With so many cool plugins available freely for WordPress, it is very easy to get carried away, and install tens of plugins, most of them adding very little value, but sometimes causing the most overhead in terms of server resources. So keep only a bare minimum of other plugins (some social plugins are a real pain – making calls to third-party web sites to get their information from).
  • If you are hosting on a shared (a.k.a “cheap”) web host paying just a few dollars a month for hosting, then your web site is basically competing for server resources (like memory and bandwidth and database access) with possibly tens (or even hundreds) of other web sites on that same server (many may not belong to you, but to others with whom you are sharing the server – and hence the name “shared hosting”).Search for the keywords “digg effect” or “slashdot effect” on Google, and you’ll see how many WordPress sites crash when a link to the site appears among the top results in popular social sites like Digg.com, Reddit.com or Slashdot.com.

    If your traffic levels have outgrown your server, then the best thing you can do is to upgrade to a bigger server, or get a Virtual Private Server, or even get a dedicated host, depending on your budget. See our recommended web hosts list.

The “Smart Login” Process

DAP has a “Smart Login” feature, where the login process will work slightly differently under different conditions, all designed to make the user-experience for your member more smooth and consistent with general log in standards around the web.

So let’s see the various possible login locations in DAP.

But first, it is important to note that DAP has two main types of logins.

Primary Login

This is where it is considered a “generic” login by your member. For eg., a member came to your web site, and then just generally wants to log in to the member’s area – so they have no “context” – it’s NOT as if they were trying to view a specific page or post, got challenged with a login form, and then logged-in from there. That makes this a “Primary Login“.

Examples of this are…

a) You have a dedicated login page, like http://YourSite.com/login/ – which is what you’ve entered in to “Setup > Config > Login URL“. The body of this page has the DAP merge tag for the login form, which is %%LOGIN_FORM%%

b) Login/Logout Widget on the home page of your web site. This is also considered a primary login, because they just came back to your site, and just wish to log in to their member’s area to see what’s new.

Secondary Login

This is a log in action that HAS “context”. Say, a member landed deep into your site (not the home page, not the dedicated login page) and tried to log in from, say, the widget on the side-bar, or were challenged by the “In Page Error Message” that says something like “Sorry, you must log in before you can view this content” and are presented with a login form right on that very same page. They were trying to read something before they were asked to log in first – which means, they must be returned to the same page they were trying to view BEFORE they were asked to login. So that makes this a “Secondary Login“.

Examples of this are…

a) Login/Logout Widget on any page EXCEPT the home page.

b) Any custom “Error Page”, where you have inserted the DAP merge tag for the login form, %%LOGIN_FORM%%.

c) DAP’s “In-Page Error Message” which says “Sorry, this is private content – you must log in first before you can view this”.

So now that you know what’s a Primary Login and what is a Secondary Login,

Redirection Rules

Based on whether it’s a Primary Login or a Secondary Login, your member will be redirected to a different location.

1) If it is a Primary Login action, then…

a) They’re taken to the “Post-Login URL” if set at a Product-level AND they have access to just one Product.
b) They’re taken to the GLOBAL “Post Login URL” (under Setup > Config) if you have NOT set anything at a Product-level, OR if they have access to more than one Product.

This scenario is the only one where the Post-Login URL is ever used (whether it’s the Product-level or Global-level).

1) If it is a Secondary Login action, then…

They’re always redirected back to the same page they were on (or were trying to access) before they were challenged to log in first to view the content.

Bottom-line:

Primary Login is predictable, and you (the DAP Admin) control where they go right after they login.

Secondary Login depends on “context”, and they’re taken back to whatever page they were before they logged in.

Secure RSS Feeds

Starting DAP v4.2, each of your members can now get their own unique RSS feed link that they can use with a feed reader (like Google Reader, FeedBlitz, iTunes, etc) to get a custom RSS feed with content that they’re eligible to view.

To give each of your members their own unique RSS Feed URL, just insert the following line of code into the top of the “Member Links” or “My Content” type page, or wherever you want your users to see their personalized RSS feed link…

If your blog is in the root…

http://YourSite.com/feed/?key=%%ACTIVATION_KEY%%

If your blog is in a sub-folder (say “/blog”)…

http://YourSite.com/blog/feed/?key=%%ACTIVATION_KEY%%

 

The text %%ACTIVATION_KEY%% in the above URL will be replaced with their own custom key, like…

http://YourSite.comcom/feed/?key=123456789

They can then copy that link, enter that into any feed reader, and it will show content specific to their account.

Custom Feed Link Security

Another useful feature we’ve added, is that the custom feed link also does IP count validation. So if they share  the feed link with others, then after “X” unique IP login attempts (where “X” is configurable by you, the DAP Admin, in Setup > Config), their account will automatically get locked out.

Hiding Protected Links On Member Home Page

When you have hundreds of posts or pages protected as part of a DAP Product, the list of links on the DAP Member Home Page (that is the result of using the merge tag %%USERLINKS%%) can get quite long and unwieldy.

So you can choose to hide some of those links from being displayed on the member’s home page.

Here’s how you hide a link from being shown on the member’s home page…

1) Go to the DAP Product in question, scroll down to the ContentResponder section

2) Click on the edit link next to the content in question on the right. The “Edit Files” popup will then show up on the left.

3) Set “Display On User’s Home Page” to “N”.

That’s it.

The content is still part of that product, it is still being protected, but the link simply won’t be displayed on the member home page.

DAP’s “Pause Membership” Feature

How It Works

Joe Member joins your site on 01/01/2011.

He stays a member for about 3 months. Let’s say it’s now mid March. He wants to take a couple of months break. So he goes on a 2 month break. Comes back end of May and wants to resume his membership.

DAP allows him to pick up right where he left off – which is continuing to receive content as of April (04/01/2011), even though today’s date is May 25th, 2011.

So while he took a break, other members who did not take a break in membership, continued to pay for those 2 months, and continued to receive content dripped through those months. So it is only fair that when he does come back end of May and resumes his subscription, he does not resume from June’s content, but from April’s content (when he last put his membership on “Pause”).

It’s ok if you’re not dripping content on a monthly-basis, but rather on a “day” basis. So to put it in terms of “days”, when Joe resumes his subscription, since he was already 90 days old in the system when he put his subscription “On Hold”, and comes back another 60 days later (roughly about 2 months), then DAP will start dripping Day #91 content onwards for him, and NOT Day #151 onwards (he didn’t pay for 2 months in between).

This is how DAP works right out of the box. Nothing special to configure. And DAP automatically takes care of pausing the dripping when he is not paying.

WARNING: Just remember that in order for you to put his actual payments on hold, you will need to have a payment gateway like Authorize.net or Paypal Website Payments Pro. Or you must be using a shopping cart like http://1SiteAutomation.com . Using something like Paypal Standard or ClickBank will not allow you to put the actual charging of his credit card on hold.

NOTE: If you actually did want him to start receiving current content even though he left for 2 months, then all you have to do is, once he comes back and starts paying again, just extend his access end date on his account (which will initially be showing 03/31/2011 – end of March, when he left) and modify it and make it 05/31/2011. So when his next payment comes in after he resumes, DAP will extend his access end date to 06/30/2011 – which means, he can now access all of the current content.

Conflict With “Cache” Related Plugins

DAP currently does not work with any “Cache” related plugins, and the reason is quite simple, actually.

Cache plugins are built on the premise that they will “cache” (save and store the contents of) WordPress pages and posts – which usually don’t change for “non-membership” type regular blogs – in a easy to retrieve, static file, so that WordPress doesn’t have to go to the database to load the contents of the page or post each and every time, which will improve the performance and loading time of your WordPress blog in general.

But the fact that such plugins are actually designed to “skip” interactions with the database as much as possible, and will make a “static copy” of your page or post and serve the same static copy to all visitors regardless of who they are, completely goes against the concept of a membership site.

The idea behind using a membership plugin like DAP, it to make sure that different visitors see different content: For ex.,

1) Casual visitors (Non-Members) who have NOT yet signed up for your products, should see content differently than …

2) Members who may have purchased one of your products, but not the product that gives them access to a specific page or post, who should see content differently than…

3) Members who actually have purchased the right product and DO have access to the content, who should see content differently than…

4) Ex-Members who signed up for your subscription-based content in the past, but have since canceled or allowed their access to expire

So, DAP tries to figure out who the visitor is first, and then packages the very same content differently to each category of visitors.

And installing a “cache” plugin kind of makes the whole point of a membership plugin meaningless. Both plugins basically contradict each other in what they’re trying to do.

One (your cache plugin) is trying to speed things up by not going to the database every time, while the other wants to make sure all of the right settings are loaded from the database to make sure your content stays secure from un-authorized access.

So, while cache plugins may work for the average, non-membership, static blog where a single post or page is not really meant to be shown differently to different people, it’s not a good idea to use it on a membership-site.